AI agents that work on your computer can read, edit and delete your files. Anthropic, OpenAI and Google each document how their agents get that access and what stops them. We read the file-access pages for four products on November 8, 2026: Anthropic’s Claude Cowork and Claude Code, OpenAI’s Codex and Google’s Gemini CLI.
Three of the four, by our count, tell users in those pages to keep backups or use version control. All four describe an approval step before actions, and all four describe a setting that removes it.
Business Pill · AI Agents
An evergreen Business Engineer explainer on AI agents. It teaches the general idea only and does not discuss the products, settings or documentation in this piece.
The key insight: Anthropic, OpenAI and Google each document an approval step for their AI agents and a setting that removes it; by our count, three of the four products’ pages also tell users to keep backups or use version control.
Anthropic’s Cowork safety page splits an agent’s tools into two groups: read tools that “let Claude access and read content” and write tools that “let Claude perform actions in your environment.” Its example of a write action is to “delete a file.”
That split is the frame for this explainer. Each vendor below answers the same four questions in its docs: what the agent can touch by default, how a user approves an action, what sandbox contains it, and how to undo a mistake.
File-access controls that Anthropic, OpenAI and Google describe in their own documentation for four AI agents, read November 8, 2026. A filled dot means documented (on by default where relevant); a half dot means available but off by default or user-enabled; an empty dot means not found on the pages we read. Classification is ours. Cowork’s sandbox covers code it runs, not computer use.
Anthropic: Claude Cowork
Access: Anthropic says Claude reaches local files “only for the folders you’ve connected.” Code runs in “an isolated, temporary environment on Anthropic’s servers,” which the page says is removed when the session ends.
Approval: the page describes three modes, “Manually approve,” “Automatically approve” and “Skip all approvals.” It says that in “Skip all approvals,” nothing checks Claude’s actions. Separately, “Cowork requires your explicit permission before permanently deleting any files.”
Limits: Anthropic says computer use, unlike file operations, “has no sandbox between Claude and what’s on your screen.” Backups: the page advises creating “a dedicated working folder for Claude rather than granting broad access,” and to “keep backups of important files.”
Anthropic: Claude Code
Approval: Claude Code’s permissions docs say the default mode “Prompts for permission on first use of each tool.” File reads inside the working directory need no approval. Editing files needs approval, and a “don’t ask again” choice lasts until the session ends. For shell commands, the same choice is stored “Permanently per repository and command.”
Modes: the docs list others, including “acceptEdits,” which accepts file edits automatically, “plan,” which reads but does not edit, and “bypassPermissions,” which “Skips permission prompts” except for actions the docs say no mode auto-approves. Sandboxing is a separate feature the docs point to for filesystem and network enforcement.
Undo: Claude Code’s checkpointing docs say it “automatically tracks Claude’s file edits as you work.” The same page says a file changed only by shell commands “isn’t tracked and stays as it is. To revert it, use version control, such as Git.” Snapshots are cleaned up by default about 30 days after the session last saved one.
OpenAI: Codex
Access and sandbox: OpenAI’s Codex security docs say that locally, Codex uses “an OS-enforced sandbox that limits what it can touch (typically to the current workspace).” For the command-line tool and IDE extension, “Defaults include no network access and write permissions limited to the active workspace.”
Approval: an approval policy sets when Codex must stop and ask. In the preset OpenAI calls Auto, Codex edits and runs commands inside the working folder on its own and asks before editing outside it or using the network. The docs also refer to a full-access setting, “–yolo.”
Version control: “Codex works best with a version control workflow,” the docs say, and they advise users to “Commit frequently so you can roll back in small increments.”
Google: Gemini CLI
Approval: Gemini CLI’s settings reference lists the default approval mode as one that prompts for approval, with an edit-approving mode and a read-only plan mode as alternatives. It says “YOLO mode (auto-approve all actions) can only be enabled via command line.”
Sandbox: the sandbox docs describe sandboxing as something a user turns on with a flag, an environment variable or a setting. On macOS, the default sandbox profile “confines writes to the project directory while allowing broad file reads and network access.” A separate Trusted Folders feature is, per its docs, “disabled by default.”
Undo: Google’s checkpointing docs describe a snapshot taken before any AI file change, stored in a shadow Git repository and restored with a command. The page also says “The Checkpointing feature is disabled by default.” We did not find a backup or version-control recommendation on the Gemini CLI pages we read.
Our Number
By our count, three of the four products’ file-access docs tell users to keep backups or use version control: Claude Cowork, Claude Code and Codex. Two document a built-in undo for AI edits: Claude Code’s checkpoints, which its docs describe as automatic, and Gemini CLI’s, which its docs say are off by default. We did not find one on the Cowork or Codex pages we read.
Every one of the four documents a setting that removes the approval step: Cowork’s “Skip all approvals,” Claude Code’s bypass mode, Codex’s full-access setting and Gemini CLI’s YOLO mode.
Anthropic’s page puts the responsibility plainly: “You remain responsible for all actions taken by Claude performed on your behalf.”
The Structural Read
As we read the four sets of docs, the undo burden sits in different places: Claude Code and Gemini CLI describe built-in checkpoints, while the Cowork and Codex pages we read point users to backups or version control.
As we read them, the approval step is a setting rather than a fixed property: each vendor documents a way to remove it, from Cowork’s ‘Skip all approvals’ to Gemini CLI’s YOLO mode.
As we read Anthropic’s Cowork page, the sandbox and the file access are separate questions: Claude’s code runs in an isolated cloud environment, while folders you connect on your computer stay reachable.
OpenAI, Codex documentation
“Treat Codex suggestions like any other PR”
Three Implications
FOR INDIVIDUAL USERS Anthropic’s Cowork page advises a dedicated working folder for Claude and backups of important files.
FOR DEVELOPERSOpenAI’s Codex docs advise committing frequently so changes can be rolled back in small increments.
FOR TEAMS Claude Code’s docs say a file changed only by shell commands is not tracked by its checkpoints and point to version control such as Git.
The analysis says: “The surface, not the model, governs autonomy.”
As we read it, the permission settings in this explainer are part of that surface: each vendor documents both an approval step and a way to remove it. The analysis does not discuss file backups.
What Is Not Established
These are the vendors’ own descriptions, read on November 8, 2026; product behaviour and docs change, and we did not test the products. Where we say something was not found, we mean not on the pages we read, not that a feature or recommendation does not exist elsewhere. The Cowork page shows no publication date; Gemini CLI’s checkpointing page was last updated on April 10, 2026, per GitHub.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
All four AI agents we checked document an approval step before actions and a setting that removes it. Three of the four products’ docs, by our count, also tell users to keep backups or use version control.
A note on sourcing. Every product description is from the vendor’s own documentation, read on November 8, 2026; documentation changes over time. The classification and counts are ours. We did not test the products. This piece is not investment advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
